Types of AI in Healthcare: Technical and Functional Categories

The types of AI in healthcare are easiest to understand by the job they perform: perceive a signal, predict an event, extract information, generate content, recommend an action, monitor a patient, operate a service, or support research. A second classification describes the technical method, such as rules, supervised machine learning, computer vision, natural language processing, or a generative foundation model.

Healthcare AI can therefore be classified on two axes. Technical families and capabilities include rules and knowledge systems; supervised, unsupervised, representation, and reinforcement learning; deep-learning architectures; computer vision; natural language processing; generative and foundation models; and adaptive or robotic control systems. Functional types include perception and detection, prediction and risk stratification, language extraction and retrieval, documentation and communication, decision support, monitoring and intervention, administration and operations, and research or population health. These labels overlap, so each deployed function still needs its own evidence, failure controls, and accountable review.

Both views matter. The technical family helps a team understand how a system learns and changes. The functional category reveals what can happen to a patient, clinician, queue, or record when the output is wrong.

A radiology detector and an ambient note generator may both use deep neural networks, yet their outputs, evidence, failure modes, and review workflows are completely different. Conversely, one clinical decision-support function may combine rules, retrieval, prediction, and generative AI behind a single interface.

This guide gives healthcare teams a practical taxonomy rather than a list of fashionable model names. It separates independent evidence from category-wide claims, identifies where human oversight must occur, and shows how to evaluate a specific product without assuming that evidence for one AI subcategory transfers to another. Sources and regulatory pages were last checked on August 28, 2026.

Two ways to classify AI in healthcare

There is no single universal list of healthcare AI subcategories. A technical taxonomy asks how the model produces an output. A functional taxonomy asks what the output does inside healthcare. Mixing those two questions creates vague categories and weak comparisons.

Technical classification: how the system works

Technical labels include machine learning, deep learning, computer vision, natural language processing, and generative AI. They describe architecture or method. These labels are useful when evaluating data requirements, training, version change, validation, and characteristic model behaviour.

They do not establish intended use or risk. The same large language model could reformat approved text, draft a clinical note, answer a benefits question, or propose a differential diagnosis. Each use has a different consequence if the output is incomplete or unsupported.

Functional classification: what the output changes

Functional labels include detection, prediction, documentation, recommendation, monitoring, and administration. They connect the system to a user, workflow, action, and failure path.

This guide treats the functional category as the primary classification because healthcare organizations govern deployed services, not algorithms in isolation. The model, data pipeline, interface, user, policy, response process, monitoring, vendor update path, and manual fallback together form the system.

The NIST AI Risk Management Framework uses this broader system perspective. The FDA, Health Canada, and MHRA transparency guiding principles for machine learning-enabled medical devices are non-binding principles that emphasize lifecycle information and the performance of the human-AI team, not a model score alone. For a wider governance treatment across clinical and business functions, see Vero's guide to AI in healthcare.

Technical families and capabilities used in healthcare AI

These labels do not sit at one level of a hierarchy. Some describe a reasoning approach, some a learning paradigm, some a model architecture or output family, and others a capability, input domain, or control system. They overlap inside real products. Use the crosswalk to identify which evidence, version, data, and change controls matter; do not force a product into one technical box.

Technical crosswalk

Dimension, mechanism, output, and boundary

Technical label	Dimension	What it does	Typical output	Important boundary
Rules and knowledge systems	Reasoning and knowledge approach	Apply explicit logic, thresholds, or encoded clinical knowledge.	Alert, recommendation, calculation, or pathway step	Rules are inspectable, but they can become stale, conflict, or fire without enough context.
Supervised machine learning	Learning paradigm	Learn a mapping from labelled examples to a classification or numeric estimate.	Risk score, probability, category, or forecast	Performance depends on labels, prevalence, calibration, missing data, and the deployment population.
Unsupervised and representation learning	Learning paradigm and representation method	Find structure, similarity, or latent patterns without one fixed outcome label.	Cluster, embedding, anomaly, or patient similarity	A mathematically distinct group is not automatically a clinically meaningful phenotype.
Deep learning and computer vision	Architecture family and visual capability	Use multilayer neural networks to learn complex features from images, signals, or sequences.	Detection, segmentation, reconstruction, measurement, or signal classification	Models can be sensitive to equipment, acquisition, site, prevalence, and unfamiliar inputs.
Natural language processing	Language capability and input domain	Extract, classify, retrieve, or transform information in clinical language.	Entity, code candidate, summary, search result, or routed message	Negation, temporality, attribution, abbreviations, and copied text can change the meaning.
Generative and foundation models	Model and output family	Generate new text, images, audio, code, or multimodal content from prompts and context.	Draft note, answer, explanation, synthetic content, or recommendation	Fluent output can contain unsupported additions, material omissions, false citations, or hidden uncertainty.
Reinforcement learning, robotics, and adaptive control	Learning paradigm and physical control system	Select or optimize actions through feedback, control logic, or interaction with an environment.	Action policy, dose suggestion, device motion, scheduling policy, or control signal	Action errors propagate into the physical or operational system, so autonomy and safe fallback matter.

1

Rules and knowledge systems

Dimension

Reasoning and knowledge approach

Mechanism

Apply explicit logic, thresholds, or encoded clinical knowledge.

Output

Alert, recommendation, calculation, or pathway step

Boundary

Rules are inspectable, but they can become stale, conflict, or fire without enough context.

2

Supervised machine learning

Dimension

Learning paradigm

Mechanism

Learn a mapping from labelled examples to a classification or numeric estimate.

Output

Risk score, probability, category, or forecast

Boundary

Performance depends on labels, prevalence, calibration, missing data, and the deployment population.

3

Unsupervised and representation learning

Dimension

Learning paradigm and representation method

Mechanism

Find structure, similarity, or latent patterns without one fixed outcome label.

Output

Cluster, embedding, anomaly, or patient similarity

Boundary

A mathematically distinct group is not automatically a clinically meaningful phenotype.

4

Deep learning and computer vision

Dimension

Architecture family and visual capability

Mechanism

Use multilayer neural networks to learn complex features from images, signals, or sequences.

Output

Detection, segmentation, reconstruction, measurement, or signal classification

Boundary

Models can be sensitive to equipment, acquisition, site, prevalence, and unfamiliar inputs.

5

Natural language processing

Dimension

Language capability and input domain

Mechanism

Extract, classify, retrieve, or transform information in clinical language.

Output

Entity, code candidate, summary, search result, or routed message

Boundary

Negation, temporality, attribution, abbreviations, and copied text can change the meaning.

6

Generative and foundation models

Dimension

Model and output family

Mechanism

Generate new text, images, audio, code, or multimodal content from prompts and context.

Output

Draft note, answer, explanation, synthetic content, or recommendation

Boundary

Fluent output can contain unsupported additions, material omissions, false citations, or hidden uncertainty.

7

Reinforcement learning, robotics, and adaptive control

Dimension

Learning paradigm and physical control system

Mechanism

Select or optimize actions through feedback, control logic, or interaction with an environment.

Output

Action policy, dose suggestion, device motion, scheduling policy, or control signal

Boundary

Action errors propagate into the physical or operational system, so autonomy and safe fallback matter.

1. Rules and knowledge systems

Rules-based systems apply explicit logic, thresholds, formulas, or encoded clinical knowledge. Examples include dosage calculators, interaction alerts, order sets, eligibility checks, and pathway prompts.

Rules are often more inspectable than learned models, but inspectable does not mean safe. A threshold can be outdated, a rule can ignore missing context, and many individually reasonable alerts can create collective overload. Teams need content ownership, release dates, exception handling, and a way to test which rule fired and why.

2. Supervised machine learning

Supervised learning uses labelled examples to learn a mapping from inputs to a known target. The result may be a probability, risk score, category, or forecast. Common examples include deterioration prediction, image classification, readmission risk, and message routing.

Performance depends on the target label, prevalence, missing data, calibration, acquisition conditions, and population. A high area under the receiver operating characteristic curve does not tell a hospital how many alerts it can manage or whether a threshold improves outcomes.

3. Unsupervised and representation learning

Unsupervised methods look for clusters, similarity, anomalies, or latent structure without one fixed outcome label. Representation learning creates useful numerical encodings, often called embeddings, for images, signals, or text.

These techniques support cohort discovery, similarity search, anomaly detection, and retrieval. Their outputs need interpretation. A cluster can be mathematically stable while having no clinically useful meaning, and a similar note is not necessarily evidence for the current patient.

4. Deep learning and computer vision

Deep learning uses multilayer neural networks to learn complex features from large datasets. Computer-vision systems apply these methods to images and video. In healthcare, they can detect, segment, reconstruct, measure, or prioritize findings in radiology, pathology, ophthalmology, dermatology, ultrasound, and endoscopy.

The FDA's AI-enabled medical-device page lists devices authorized for specific functions and links to public decision summaries. FDA notes that the list is not comprehensive. Inclusion supports the authorized function, not every feature from the manufacturer or performance in every population and setting.

5. Natural language processing

Natural language processing, or NLP, extracts, classifies, retrieves, and transforms information in clinical language. It can identify a medication, detect negation, route an inbox message, retrieve source passages, suggest a candidate code, or summarize a record.

Clinical meaning is sensitive to who said something, when it occurred, whether it was denied, and whether text was copied from an older note. A useful NLP interface should expose the source span and retain context so a user can verify the result rather than accepting a detached label.

6. Generative and foundation models

Generative systems create new text, images, audio, code, or multimodal content. Foundation models are trained broadly and can be adapted to many tasks. In healthcare, they can support draft documentation, patient communication, summarization, evidence retrieval, synthetic data, and decision support.

Fluency is not verification. A generated answer can add a diagnosis that was not supported, omit a material negative, invent a citation, merge two speakers, or express uncertainty as fact. The World Health Organization's guidance on large multimodal models describes false, biased, incomplete, and inaccurate outputs as core risks across health uses.

7. Reinforcement learning, robotics, and adaptive control

Reinforcement learning selects actions based on feedback or a defined reward. Robotics and adaptive-control systems combine sensing, planning, and physical or operational action. Applications can include robotic assistance, resource allocation, treatment optimization, and closed-loop device behaviour.

These systems require attention to autonomy. A recommendation that a clinician reviews is different from an output that changes a device setting. Safe states, hardware limits, manual control, response time, and rollback become as important as model performance.

Eight functional types of AI in healthcare

Functional categories make an AI system easier to govern because they name the input, output, action, and accountable user. The same product may have several functions, but each function should be evaluated separately.

Functional map

Eight types defined by what changes in care

1

Perception and detection

Radiology, pathology, retinal imaging, ECG, ultrasound, and signal interpretation

Images or physiological signals become a detection, segmentation, measurement, reconstruction, or priority flag.

Evidence reality

Technical validation is common; comparative clinical evidence exists for some defined products and workflows.

Characteristic failure

Missed finding, false positive, unreadable input, equipment shift, or performance loss in an unfamiliar population.

Human oversight

A qualified user verifies image or signal quality, reviews the source, and owns the downstream action.

2

Prediction and risk stratification

Deterioration, readmission, sepsis, mortality, no-show, and treatment-response risk

Longitudinal or real-time data become a probability, trajectory, risk tier, or ranked queue.

Evidence reality

Discrimination may be well studied, but outcome benefit depends on timing, response capacity, and workflow.

Characteristic failure

Miscalibration, alert overload, proxy bias, missing data, late prediction, or no accountable response.

Human oversight

Teams define thresholds, response ownership, capacity, overrides, escalation, and silent-system fallback.

3

Language extraction and retrieval

Chart search, coding support, registry abstraction, inbox routing, and evidence retrieval

Text becomes structured concepts, candidate codes, classifications, citations, or retrieved passages.

Evidence reality

Evaluation can be reproducible when reference labels and source passages are available.

Characteristic failure

Wrong patient, missed negation, lost chronology, unsupported code, stale source, or irrelevant retrieval.

Human oversight

Users see the source span, verify the result in context, and do not treat a candidate as a final decision.

4

Generative documentation and communication

Ambient notes, summaries, letters, portal drafts, discharge instructions, and translation drafts

Speech, text, and retrieved context become a new narrative or structured draft.

Evidence reality

Workflow studies are growing, but results are product-, setting-, adoption-, and task-specific.

Characteristic failure

Unsupported statement, material omission, false certainty, speaker error, wrong-patient content, or note bloat.

Human oversight

A responsible clinician compares the draft with the source, corrects it, and authenticates the final record.

5

Clinical decision support and recommendation

Differential support, order suggestions, medication review, triage, and guideline-based recommendations

Patient-specific facts and knowledge become an option, recommendation, rationale, or next-step prompt.

Evidence reality

Benchmarks and vignette studies can test reasoning, but live benefit requires workflow and outcome evaluation.

Characteristic failure

Automation bias, incomplete context, unsafe recommendation, opaque rationale, or inappropriate use outside scope.

Human oversight

The clinician can independently review the basis, reject the output, and escalate uncertainty.

6

Monitoring and adaptive intervention

Remote monitoring, bedside surveillance, wearables, closed-loop devices, and robotic assistance

Continuous data become an alert, escalation, device adjustment, or physical action.

Evidence reality

The whole service must be evaluated because signal accuracy alone does not prove a timely clinical response.

Characteristic failure

Disconnected device, silent alert, delayed response, control instability, unsafe action, or missing follow-up.

Human oversight

The service specifies availability, response time, escalation, manual control, downtime, and action ownership.

7

Administrative and operational AI

Scheduling, staffing, claims, supply, prior authorization, routing, and revenue-cycle work

Operational data become a forecast, prioritization, classification, assignment, or automated task.

Evidence reality

Efficiency can be measured directly, but clinical access, equity, denial, and queue effects also matter.

Characteristic failure

Unequal access, hidden denial logic, brittle automation, exception backlog, or optimization of the wrong target.

Human oversight

Operations owners monitor service levels, exceptions, subgroup effects, appeals, and downstream patient impact.

8

Research, discovery, and population health

Cohort finding, surveillance, molecule generation, trial design, literature synthesis, and public health

Research or population data become a hypothesis, candidate, pattern, synthetic dataset, or study aid.

Evidence reality

Outputs can accelerate exploration, but they remain hypotheses or analytical results until independently validated.

Characteristic failure

Data leakage, irreproducibility, spurious target, fabricated source, privacy breach, or inequitable population model.

Human oversight

Researchers preserve provenance, preregister evaluation where appropriate, reproduce results, and follow ethics review.

1. Perception and detection

Perception systems turn images or physiological signals into a finding, measurement, highlighted region, reconstruction, classification, or priority flag. They are common in radiology, pathology, retinal imaging, ECG interpretation, and other signal-based specialties.

The primary risk is not just a false result. Image quality, equipment, acquisition protocol, anatomy, prevalence, and site can change performance. A positive flag may also create extra diagnostic work. Human review must include access to the source image or signal, input-quality checks, and an accountable process for acting on the result.

2. Prediction and risk stratification

Predictive AI estimates a future event, current hidden state, or probability. Health systems use it for deterioration, readmission, mortality, no-show, treatment response, and resource planning.

Prediction becomes an intervention only when it reaches the right person in time and triggers an achievable response. Teams should evaluate calibration, threshold selection, alert volume, response ownership, subgroup performance, silent failures, and whether the workflow can absorb false positives.

3. Language extraction and retrieval

Extraction systems turn unstructured language into structured concepts, classifications, candidate codes, or routed requests. Retrieval systems find potentially relevant passages, records, or publications.

These systems can be tested against reference labels and known source passages. Their interface should show where the answer came from. Candidate coding output still needs qualified review, and retrieved evidence still needs assessment for population, date, quality, and applicability.

4. Generative documentation and communication

Generative documentation tools create a new draft from speech, text, or retrieved context. Examples include ambient notes, summaries, referral letters, portal replies, discharge instructions, and translations.

The output is a draft, not a verified record. In a clinical workflow, the responsible clinician needs the source information, time to review, an efficient correction interface, and authority to reject the output. Vero's guide to medical scribes for doctors compares the workflow and failure paths of human and AI documentation support.

5. Clinical decision support and recommendation

Recommendation systems propose an option, action, explanation, or next step using patient information and clinical knowledge. They may support differential diagnosis, medication review, order selection, triage, or guideline adherence.

The FDA's January 2026 clinical decision-support guidance explains that some clinical decision-support functions are excluded from the US medical-device definition while others remain device functions. The actual function and statutory criteria matter. Calling a feature “decision support” does not determine its status.

6. Monitoring and adaptive intervention

Monitoring systems analyze continuous or repeated data from bedside devices, home equipment, wearables, or longitudinal records. Their output may be an alert, escalation, or device adjustment.

Signal accuracy alone does not prove the service works. The evaluation needs to include device non-use, missing data, connectivity, response time, contact attempts, escalation, manual fallback, and closure. People who cannot maintain a complete data stream should be included in testing.

7. Administrative and operational AI

Administrative AI supports scheduling, staffing, claims, prior authorization, supply, routing, documentation operations, and revenue-cycle work. These systems are sometimes described as low risk because they do not issue a diagnosis.

Operational decisions can still change access and equity. A scheduling model can delay a patient, a denial model can create an appeal burden, and a staffing optimizer can shift workload toward an unsafe queue. Teams should monitor exceptions, service levels, subgroup effects, denials, appeals, and downstream clinical consequences.

8. Research, discovery, and population health

Research AI can identify cohorts, detect population patterns, synthesize literature, generate molecular candidates, analyze trial data, or help design studies. The output is a hypothesis or analytical result until it is independently tested.

Provenance and reproducibility matter. Teams should preserve datasets and versions, document transformations, verify citations, assess data rights, prevent leakage, and use research ethics review where appropriate. A generated candidate does not bypass the experimental and regulatory pathway needed to establish safety and benefit.

What the clinical evidence shows

Evidence for healthcare AI is mixed because “healthcare AI” is not one intervention. A study result belongs to the tested product version, users, population, setting, workflow, comparator, endpoint, and follow-up period.

Comparative evidence

The category does not predict the result

Randomized studies show positive, null, and mixed findings. The tested intervention and workflow remain part of every conclusion.

Perception

MASAI mammography screening trial

AI-supported screening detected more cancers and reduced screen-reading workload in the tested Swedish workflow.

Do not overgeneralize

The result belongs to the tested product version, population, protocol, comparator, and follow-up; it is not evidence for every imaging model.

Prediction

2026 passive deterioration-display trial

A cluster-randomized trial across 10,422 inpatient visits found no improvement in its primary deterioration outcome.

Do not overgeneralize

The display did not mandate a response, and movement between display-on and display-off beds complicated interpretation.

Predictive alert

Multisite AI-ECG mortality alert trial

The intervention was associated with lower 90-day all-cause mortality: 3.6% versus 4.3%.

Do not overgeneralize

This supports one alert-and-response workflow; it does not validate unrelated risk scores or passive dashboards.

Generative documentation

Randomized ambient-scribe trial

One of two tested products reduced time in note, while both showed possible improvements in several clinician-reported outcomes.

Do not overgeneralize

Adoption was incomplete, secondary outcomes need confirmation, and clinicians still reported occasional clinically significant inaccuracies.

LLM decision support

Two randomized physician-vignette studies

A 50-physician diagnostic study found no significant reasoning improvement; a 92-physician management study found a 6.5-point score difference.

Do not overgeneralize

Both used simulated cases. Task design, interface, model, scoring, time, and user behaviour differed.

A positive imaging trial does not validate a documentation model

The MASAI randomized mammography screening trial reported higher cancer detection and lower screen-reading workload with the tested AI-supported screening process. This is meaningful evidence for that product version and Swedish screening protocol. It does not prove that every image model improves care, and it says nothing about the reliability of a generative note.

Predictive systems can help, do nothing, or create work

In a multisite randomized AI-ECG alert trial, 90-day all-cause mortality was 3.6% in the intervention group and 4.3% in the control group, with a hazard ratio of 0.83 and a 95% confidence interval from 0.70 to 0.99. The result supports one defined alert-and-response system.

A separate 2026 cluster-randomized trial of passive predictive analytics across 10,422 inpatient visits found no improvement in its primary deterioration outcome. The score display did not require a response, and movement between beds with different display states complicated interpretation. This illustrates why a prediction and its response workflow must be evaluated together.

Generative tools need workflow outcomes and error review

A randomized trial of ambient AI scribes enrolled 238 outpatient physicians across 14 specialties. One tested product was associated with a 9.5% decline in time in notes; the other did not show a significant change in that measure. Both showed possible improvements in several clinician-reported secondary outcomes. Adoption was incomplete, and clinicians reported occasional clinically significant inaccuracies.

Two physician-vignette trials also reached different conclusions. A 50-physician study found no significant improvement in diagnostic-reasoning scores with GPT-4 access. A 92-physician patient-management study found a 6.5 percentage-point improvement, with more time spent on cases. Both used simulated cases, and their tasks, interfaces, scoring, and workflows differed.

Vendor evidence is not automatically independent evidence

A vendor can fund a rigorous study, and an independent study can still have serious limitations. The useful distinction is transparency, not a simple vendor-versus-peer-review label.

For every claim, record the product and model version, intended use, users, study design, comparator, inclusion and exclusion criteria, setting, prevalence, reference standard, primary endpoint, confidence interval, failed inputs, subgroups, missing outcomes, funding, author roles, and conflicts. Then state exactly what the evidence supports and what it does not.

Failure modes change with the AI subcategory

Every healthcare AI system can produce a wrong output, but error taxonomies should be category-specific.

• Detection: missed finding, false positive, unreadable input, poor segmentation, or equipment shift.
• Prediction: miscalibration, threshold mismatch, alert overload, delayed signal, or no accountable response.
• Extraction: missed negation, wrong attribution, lost chronology, unsupported code, or stale source.
• Generation: unsupported statement, material omission, speaker mix-up, false certainty, or fabricated citation.
• Recommendation: incomplete context, unsafe option, opaque basis, or use beyond intended scope.
• Monitoring: disconnected device, silent alert, delayed escalation, unsafe adjustment, or unclosed task.
• Operations: unequal access, brittle automation, denial error, exception backlog, or optimization of the wrong target.
• Research: data leakage, irreproducible result, spurious target, fabricated source, or privacy violation.

Teams should measure failures that matter to the action. Overall accuracy can hide a rare but severe omission. A polished interface can also hide unavailable inputs, uncertainty, or silent downtime.

Human oversight must match the output

“Human in the loop” is not a sufficient control description. Meaningful oversight requires a named qualified person who can see the relevant source, understand the system's role, recognize uncertainty, reject or correct the output, escalate a problem, and use a safe fallback.

Review must happen before the consequential action

A clinician signing a note after it has already been used for a referral is not timely oversight. A radiologist who cannot inspect the original image cannot verify a detection. An operations manager reviewing aggregate denial rates cannot correct a patient-level authorization delay in real time.

Map the review point to the consequence. For a draft, review precedes authentication or sending. For an alert, review precedes escalation or treatment. For a physical control signal, the system needs defined autonomy, safe states, and manual intervention.

Oversight has a workload and capacity limit

Human review can fail through fatigue, time pressure, automation bias, poor interface design, or an unmanageable queue. Measure review time, override patterns, corrections, missed alerts, exceptions, and fallback use. If the proposed control depends on review that the team cannot consistently perform, it is not an effective control.

The ASTP/ONC HTI-1 final rule established transparency requirements for predictive decision-support interventions in certified health IT. Its focus on purpose, validation, fairness, and ongoing maintenance reflects a broader need: users require useful information about a model and its deployment context, not a generic “AI powered” label.

Educational scope: This taxonomy does not establish that a product is safe, effective, authorized, private, or suitable for a patient, clinician, or organization. Verify the specific product version, intended use, evidence, regulator record, data flow, workflow, and applicable professional obligations before use.

Regulation follows the function, not the AI label

An AI system is not regulated or unregulated simply because it uses machine learning. Classification depends on intended purpose, claims, users, level of influence, and jurisdiction.

United States

FDA oversight can apply to software functions that meet the medical-device definition. Public authorization records should be checked for the specific function and intended use. Other functions may fall under different frameworks, including clinical decision-support provisions, privacy, consumer protection, professional obligations, and state requirements.

Canada

Health Canada's April 2026 guidance for machine learning-enabled medical devices describes lifecycle expectations for Class II, III, and IV devices. The guidance covers risk management, representative data, design, testing, clinical validation, transparency, post-market monitoring, and predetermined change control plans.

The guidance defines an ML-enabled medical device as a medical device that uses machine learning, in whole or in part, to achieve its intended medical purpose. An organization should verify the product's actual licence and claims rather than infer status from the word “clinical.” For current cross-border policy developments, see Vero's healthcare AI regulation tracker.

Privacy and security apply across categories

Classification as administrative, consumer, or non-device AI does not remove privacy and security responsibilities. Map what data enters the system, where it is processed, which subprocessors receive it, how long it is retained, whether it is used for model improvement, how access is controlled, what is logged, and how deletion is verified.

In the United States, HHS explains that HIPAA may not protect information entered into a personal app unless the app is provided by or on behalf of a covered entity or business associate. The FTC Health Breach Notification Rule can apply to certain health apps outside HIPAA. Those boundaries should be checked for the actual relationship and product.

How to evaluate any healthcare AI subcategory

The same seven-step workflow works across technical families because it begins with the healthcare function.

1. Name the task, user, input, output, and action

Write one sentence: “For this user and population, the system turns this input into this output so that this action can occur.” If the sentence contains several outputs or users, separate them into functions.

2. Classify both the function and technical family

Assign the primary functional category and list the technical methods that materially affect evidence or change control. Do not let a broad product label hide a higher-risk function inside a suite.

3. Trace wrong, missing, delayed, and unavailable output

Document false positives, false negatives, unsupported generation, late results, silent failure, downtime, queue effects, and physical or clinical actions. Identify the person affected and how the failure will be detected.

4. Match the claim to relevant evidence

Do not use benchmark accuracy to claim patient benefit. Check the product version, population, setting, comparator, endpoint, confidence interval, failed inputs, subgroup results, funding, and conflicts. Separate vendor demonstrations from independent evaluations and local tests.

5. Design meaningful human oversight

Give the responsible person the source information, time, interface, authority, training, escalation path, and fallback needed to intervene. Define when the system should abstain and when the user should stop using it.

6. Verify regulation, privacy, integration, and updates

Check the intended-use record in each jurisdiction, map the data flow, validate access and export, test interface failures, and require notice of material changes to the model, prompt, threshold, retrieval source, subprocessor, or integration.

7. Pilot narrowly and monitor the whole service

Baseline the current workflow. Define acceptance and stop criteria before the pilot. Test representative and difficult cases, track error categories and workload, and retain a manual fallback. Expand only when local evidence shows useful benefit with controllable risk.

A practical classification example

Consider an ambient documentation tool used in an outpatient visit.

• Technical families: speech recognition, NLP, retrieval, and generative AI.
• Functional category: generative documentation and communication.
• Input and output: encounter audio and approved context become a draft note.
• Consequential action: the clinician corrects and authenticates the note; the record may support communication and billing.
• Characteristic failures: speaker attribution error, omitted symptom, unsupported statement, wrong section, or failed session.
• Evidence needed: material-error rate, correction time, adoption, failed sessions, workflow time, user outcomes, and downstream note quality for the tested product version.
• Oversight: the responsible clinician can compare the draft with the encounter, correct it before signing, and return to manual documentation when the system fails.

That classification is more actionable than “uses generative AI.” It tells the team what to test, who reviews the output, where the control sits, and which claims are relevant. The same method can be applied to imaging, monitoring, risk scores, and operational systems.

Key takeaways

• Classify healthcare AI by function first and technical method second.
• Evidence is specific to a product, version, task, population, workflow, comparator, and outcome.
• Perception, prediction, extraction, generation, recommendation, monitoring, operations, and research have different failure modes.
• Human oversight is meaningful only when a qualified person has the source, time, authority, interface, and fallback to intervene.
• Regulation, privacy, integration, and change control follow the actual function and data flow, not the marketing label.
• A narrow local pilot with predefined acceptance and stop criteria is safer than category-wide adoption.

Lauren Bennett reports and edits Vero's evidence-based healthcare technology guides. She is not presented as a clinician or AI-governance specialist. No separate clinical-informatics or healthcare-AI reviewer is credited on this version. Vero's editorial policy explains how sources, corrections, and review attribution are handled.